Ronin Bridge: How Lazarus Stole $625M

A game about cute digital creatures called "axies," played by millions of people, became the scene of one of the largest thefts in the history of cryptocurrency. Behind the hack stood not a lone hacker but a state cyber group of North Korea — Lazarus. About $625M was stolen, and the money went to fund the regime's programmes. This case is a textbook on three topics at once: why bridges between blockchains are so vulnerable, what a sanctioned address looks like, and how multi-stage laundering through a mixer and cross-chain works.

▶ Video case study: Ronin and Lazarus (English narration).

The bridge as a target

The popular game Axie Infinity ran on its own sidechain called Ronin — a separate blockchain linked to Ethereum through a bridge. A bridge is needed to move assets between networks: a user "locks" tokens in one network and receives their equivalent in another. The problem is that such a bridge concentrates gigantic sums of collateral — and therefore becomes an ideal target.

On 23 March 2022 Ronin was hacked. But the most alarming thing about this story is that the theft was not noticed right away: the incident was discovered only on 29 March, nearly a week later. While the team was unaware of the breach, the attackers managed to drain the assets. The result: 173,600 ETH and 25.5M USDC — about $625 million in total — were stolen.

Attribution: a state stands behind the hack

On 14 April 2022 the case moved from the category of "major theft" to that of "national security matter." The U.S. Department of the Treasury (OFAC) officially linked the theft to the North Korean hacker group Lazarus. This is a state cyber group of the DPRK, whose operations bring the regime currency that goes, among other things, toward military programmes. Lazarus has billions of dollars in thefts across the industry to its name.

The attribution changed everything. Funds stolen by Lazarus are not just "dirty" money; this is money under direct sanctions, dealing with which is prohibited. And for the industry to be able to block these funds, a concrete reference point was needed — a sanctioned address.

The sanctioned address: what it looks like

OFAC added to the sanctions list a specific Ethereum address holding the stolen ETH — about $400M at the time:

Remember how this looks in real work. From the moment it is added to the SDN list, this set of 42 characters stops being merely a "wallet" — it becomes legally toxic. Any transfer to it or from it is a potential sanctions violation. This is exactly how the abstract idea of "sanctions against an address" turns into a concrete string that an AML system is obliged to recognize.

The real sanctioned address linked to the Ronin theft: 0x098B716B8Aaf21512996dC57EB0615e2383E2f96. In the explorer it is flagged as connected to OFAC sanctions.

Laundering: mixer → bridge → bitcoin

Having gained control over $625M, Lazarus faced the same problem as all thieves before it (recall Bitfinex): stealing is only half the job, you still have to "launder" and cash out. And here the group applied a honed multi-stage obfuscation scheme typical of the DPRK.

1. Theft from the bridge. 173,600 ETH + 25.5M USDC (~$625M) drained from the Ronin sidechain.Hacked 23 March, discovered 29 March — a window of nearly a week.
2. Run through a mixer. Part of the funds is run through Tornado Cash — a mixer that breaks the "input↔output" link.The goal is to sever traceability so the analyst can't see that this came from the stolen loot.
3. Cross-chain via the Ren bridge. The funds are moved through the Ren bridge into another network.Switching blockchains ("chain hopping") complicates end-to-end tracing between different ledgers.
4. Conversion into bitcoin. Ultimately the assets are moved into BTC.Switching asset and network is one more layer of obfuscation before the attempt to cash out.

Note the logic of this chain. Each step solves a separate obfuscation task: the mixer breaks the direct link between what was stolen and what was withdrawn; the cross-chain bridge leads the trail into another blockchain, where end-to-end tracing is harder; the asset switch into BTC adds one more layer. This is not chaotic "scattering" but an engineered, deliberate laundering conveyor that Lazarus applies from operation to operation.

Why this case is a concentrate of risks

Ronin is valuable to us because in a single case all the main AML red flags we studied separately converge at once.

• Attack on a bridgeCross-chain bridges concentrate huge collateral and are therefore a priority target. Funds from a hacked bridge are toxic by definition.
• Sanctioned addressThe specific SDN address 0x098B…2f96 is a direct ban on operations. An AML system is obliged to recognize it.
• State actorBehind the theft stands Lazarus (DPRK); the funds go toward the regime's programmes — this is the highest level of risk and regulatory attention.
• Mixer in the chainThe run through Tornado Cash is a red flag of maximum strength (see lesson 3.2).
• Chain hoppingThe Ren bridge and conversion into BTC — a deliberate switch of networks and assets to confuse the trail.